CVE-2015-0250

What it actually does

XML external entity processing in Batik SVG-to-image converters allows untrusted SVG input to resolve external entities, resulting in arbitrary local file disclosure or resource exhaustion leading to denial of service.

Why it matters to the business

Attackers may exfiltrate sensitive server files or render image conversion services unavailable, increasing risk of data exposure and operational disruption in any application relying on Batik for graphics handling.

How an attack unfolds

An attacker supplies a crafted SVG containing malicious external entity declarations to any code path that invokes Batik 1.x conversion classes; the XML parser resolves the entities against the local filesystem or network resources, leaking file contents or consuming excessive memory and CPU.

How to fix it

Upgrade Apache Batik to version 1.8 or later; configure XML parsers to disable external entity resolution and DTD processing; replace Batik usage with libraries that enforce safe SVG handling by default.

How to confirm the fix worked

Verify Batik version is 1.8 or newer in all application dependencies; run a test SVG containing a benign external entity against the conversion classes in an isolated environment and confirm no entity expansion occurs.

Typical attack path

1. Identify an endpoint or library call that accepts SVG input for Batik conversion
2. Construct SVG payload embedding XXE entity declarations targeting desired files or causing resource exhaustion
3. Submit the SVG through the conversion interface
4. Observe returned file contents or service degradation

How to detect it

Review application and web server logs for SVG conversion requests that precede unusual local file reads, high memory usage, or Batik parser exceptions; correlate with any outbound connections or large responses shortly after SVG uploads.

• SVG containing <!ENTITY
• Batik SVG conversion followed by /etc/passwd or similar file access
• High CPU or memory spikes during Batik PNG/JPG conversion

What your security team should do

• Immediately inventory all uses of Apache Batik and schedule upgrade to 1.8+
• Apply parser hardening settings to disable XXE across SVG processing code
• Add runtime checks that reject SVG input containing entity declarations
• Monitor application logs for SVG processing errors or unexpected file access attempts